I've recently added TLS related headers to my IIS server, version 8.5 running on Windows Server 2012 R2. The IIS log headers are mapped to the following server variables
- crypt-protocol - CRYPT_PROTOCOL
- crypt-cipher - CRYPT_CIPHER_ALG_ID
- crypt-hash - CRYPT_HASH_ALG_ID
- crypt-keyexchange - CRYPT_KEYEXCHANGE_ALG_ID
For a site that has 950,000 requests the TLS related headers are being recorded on all but 19 requests. Those 19 requests are over the 443 port and all return a successful status and are a combination of GET and POST requests.
Why would those 19 requests not have any TLS related values per log entry?
EDIT - The requests seem legitimate, request below with sensitive field values replaced
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken crypt-protocol crypt-cipher crypt-hash crypt-keyexchange
2020-04-10 01:07:48 SERVERIP GET VALIDURL QUERYSTRING 443 - CLIENTIP - - 200 0 0 62 - - - -